Adobe patches Flash, but doesn't get around to Pwn2Own bug

Fifth update this year for the popular media player, but this one was on the calendar

Adobe today patched Flash Player, the fifth time this year it's updated the vulnerability-plagued software.

Unlike two of the three updates last month, however, today's was part of Adobe's regularly-scheduled patch cadence.

Last November, Adobe announced it would pair its Flash security updates with the monthly Patch Tuesday releases by partner Microsoft. Adobe has fixed Flash flaws on the second Tuesday of each month since then.

The Flash update, designated APSB13-09, patched four critical vulnerabilities that included a use-after-free bug, integer and buffer overflows, and an unspecified memory corruption flaw. All could be used by attackers to execute malicious code, hack Flash and hijack a Windows PC or OS X-powered Mac.

Adobe said that none of the four vulnerabilities has been seen exploited in the wild.

Along with the update to the Flash Player browser plug-ins, Google and Microsoft issued their own patches, as they have integrated Flash with their respective Chrome and Internet Explorer 10 (IE10) browsers.

Adobe did not patch the bug or bugs that a team from Vupen, a French vulnerability research and exploit-selling firm, used to hack Flash Player at last week's Pwn2Own contest. The Vupen team was awarded $70,000 for demonstrating their hack of Flash on IE9 running in Windows 7.

Pwn2Own's sponsor, HP TippingPoint's Zero Day Initiative (ZDI) bug-bounty program, collected the vulnerabilities and attack code used by all contestants, and has passed the information along to the vendors, including Adobe.

"No surprise," said Andrew Storms, director of security operations at nCircle Security, in an instant message today, when asked about Adobe omitting a fix for the Pwn2Own vulnerability. "If Microsoft couldn't get it done by today, I wouldn't think Adobe could."

Adobe confirmed today that it plans to patch the Vupen bug(s) next month as part of its April 9 update.

Microsoft, which also issued its Patch Tuesday updates today, was in the same boat: It did not include fixes for the multiple vulnerabilities in IE10 on Windows 8 that Vupen exploited at Pwn2Own. For their IE10 feat, the French researchers received $100,000.

Adobe credited today's vulnerability reports to Google -- whose engineers sussed out two of the four; an anonymous researcher who filed with iDefense, which like TippingPoint runs a bounty program; and Attila Suszter, who writes the Reversing on Windows blog.

Suszter published technical details of his Flash find today.

The patched versions of Flash Player for Windows, Mac and Linux can be downloaded from Adobe's website. Windows and Mac users can also wait for Flash's automatic updating tool to kick in. Users of Google's Chrome and Microsoft's IE10 on Windows 8 will receive the newest Flash via those browsers' own update mechanisms.

Android 2.x, 3.x, and 4.x users who installed Flash Player before Adobe pulled the plug-in from distribution must jump through hoops to update the software. For details, check out this post by Computerworld blogger Michael Horowitz.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is

See more by Gregg Keizer on

Read more about malware and vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags GoogleMicrosoftsecurityMalware and Vulnerabilities

More about Adobe SystemsAndrew Corporation (Australia)AppleGoogleHPiDefenseLinuxMicrosoftnCircleTippingPointTippingPointTopic

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Gregg Keizer

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place